Risk Letters

Exploited vulnerability

CVE-2017-20284

TLP:CLEAR

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Caucho Resin contains a path traversal vulnerability in the documentation webapp (resin-doc) that allows remote unauthenticated attackers to read arbitrary files by supplying a relative path through the inputFile request parameter of the jndi-appconfig tutorial servlet. Attackers can craft requests with directory traversal sequences to the servlet endpoint to read files outside the intended tutorial directory on the underlying system. Exploitation evidence was first observed by the Shadowserver Foundation on 2021-12-10.

Facts

  • Vendor: Caucho Technology, Inc.
  • Product: Resin
  • EPSS (probability of exploitation within 30 days): 1.2 %
  • First known exploitation: 18 September 2026
  • First seen by Risk Letters: 18 September 2026

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD